DE102021113670A1 - Method for data transmission in a network system and network system - Google Patents

Abstract

The invention relates to a method for data transmission in a network system (1), comprising operating (S3) a network controller (20a) of a fourth network element (20) in a promiscuous mode (P) and creating (S4) an IP tunnel ( 22) between the first network (10) and the second network (14), the third network element (18) and the fourth network element (20) being respective end points of the IP tunnel (22) routed via an access element (24). . The invention also relates to a network system (1).

Description

The present invention relates to a method for data transmission in a network system. Furthermore, the present invention relates to a corresponding network system.

State of the art

For example, a conventional, non-clustered, first user node-target node scenario consists of a single user node such as a browser on a desktop PC requesting a service such as an HTML page to download and a target Network node e.g. a web server that provides the requested service.

The user network node and the target network node host the respective applications and are connected to the same network via Ethernet interfaces, e.g. "eth0". In order to be able to use the service, the user node must know the service address, which consists of the destination node IP address, e.g. 192.168.0.1, and a service port, e.g. 80 for HTTP or 443 for HTTPS connections , composed.

The port is needed to identify the service application running on the target network node. In order to be able to receive responses from the target node, the user node has its own user IP address and listens on the user port.

The service provider usually uses a predefined, static port for this, since this port must be known to every user in order to initiate a connection. The user port, on the other hand, can be created dynamically since it can be made known to the provider when the user first requests a connection.

The basic idea of cloud computing is to instantiate hundreds or even thousands of service applications on-demand, each of which runs encapsulated in a runtime environment, e.g. a container or a virtual machine. A common example of such a service application is a web server application that listens for HTTP or HTTPS requests on a predefined port.

Alternatively, for example, the target network node can be operated in a different (sub)network as part of a second user network node target network node scenario. Both nodes no longer have a direct connection, i.e. the user network node cannot reach the target network node directly and vice versa. A simple example of such a structure is a cluster in which the target network node is instantiated in the cluster and the user network node is operated outside of the cluster.

Both nodes are connected to different networks, referred to below as internal and external networks. There is an access node that has access to both the intra-cluster and the extra-cluster network. Instead of sending a service request to the destination IP and service port, the initial connection request is sent from the user network node to the access node IP and access port, and from there in turn to the cluster node IP and access port, respectively .Sent destination network node.

The destination network node is configured in such a way that it makes the service available to the external network at the access port, i.e. every request from the user network node of the external network to the access port is forwarded to the destination network node in the internal network at its service port.

In the above two application scenarios, the first connection request is directed to a static (known) port. In the first application scenario, further dynamically assigned ports can be used in the subsequent communication. For this purpose, new ports can be assigned dynamically by applications on the target network node and the existing, initial communication path can be used to signal the availability of the new ports and the associated services to the user network node.

However, this is not possible in the second application scenario. Although new ports can be dynamically assigned in the target network node, they are not accessible from the external network. Port sharing, i.e. port forwarding, usually requires static configuration.

This issue is not relevant for service applications designed to run in a cluster. However, having an existing application that uses dynamic ports can result in significant costs if it is necessary to port the application from the first application scenario to the second application scenario.

It is currently not possible to use applications that require dynamic port assignment with common container orchestration software such as Kubernetes if the dynamic port needs to be accessible from outside the cluster.

It is therefore the object of the invention to provide a method for data transmission in a network system and a corresponding network system which make it possible to operate applications which require dynamic port assignment in a cluster environment with restricted user rights.

Disclosure of Invention

The object is achieved according to the invention by a method for data transmission in a network system with the features of claim 1. The object is also achieved according to the invention by a further method for data transmission in a network system having the features of patent claim 14 .

In addition, the object is achieved according to the invention by a network system having the features of patent claim 15 . In addition, the object is achieved according to the invention by a further network system with the features of claim 16.

The invention relates to a method for data transmission in a network system. The method includes providing a first network element connected to a first network, in particular a user network node, and a second network element connected to a second network, in particular a cluster network, in particular a target network node, the second network element not having the user right has to create a virtual network interface.

The method also includes providing a physical or virtual third network element connected to the first network and a physical or virtual fourth network element connected to the second network.

In addition, the method includes operating a network controller of the fourth network element in a promiscuous mode, and creating an IP tunnel between the first network and the second network, the third network element and the fourth network element connecting respective end points of the access Element guided IP tunnels are.

The invention also relates to a further method for data transmission in a network system comprising providing a first network element connected to a first network, in particular a user network node, and a second network element connected to a second network, in particular a cluster network, in particular a destination - Network node, wherein the second network element does not have the user right to create a virtual network interface.

The method further includes providing a physical or virtual third network element connected to the second network and operating a network controller of the third network element in a promiscuous mode.

In addition, the method includes creating an IP tunnel between the first network and the second network, the first network element and the third network element being respective end points of the IP tunnel routed via an access element.

The invention further relates to a network system for data transmission between a first network element and a second network element, comprising a first network element connected to a first network, in particular a user network node.

The network system also includes a second network element, in particular a target network node, connected to a second network, in particular a cluster network, wherein the second network element does not have the user right to create a virtual network interface.

In addition, the network system comprises a physical or virtual third network element connected to the first network and a physical or virtual fourth network element connected to the second network, wherein a network controller of the fourth network element can be operated in a promiscuous mode , and wherein the third network element and the fourth network element are respective end points of an IP tunnel routed via an access element.

The invention also relates to a further network system for data transmission between a first network element and a second network element, comprising a first network element connected to a first network, in particular a user network node.

The network system also includes a with a second network, in particular a Clus ter network, connected second network element, in particular a target network node, wherein the second network element does not have the user right to create a virtual network interface.

In addition, the network system comprises a physical or virtual third network element connected to the second network, a network controller of the third network element being operable in a promiscuous mode, with an IP tunnel being created between the first network and the second network , wherein the first network element and the third network element are respective end points of the IP tunnel routed via an access element.

An idea of the invention is thus to create an IP tunnel for Ethernet frames when user and/or destination nodes are operated in a restricted environment that does not allow the establishment of conventional IP tunnels.

Ethernet frames sent by the user node and destined for the destination node must be captured on the external network and injected on the internal network and vice versa.

Therefore, within the scope of the invention, virtual Ethernet devices or network elements are inserted into the internal and external network, which are responsible for detecting, forwarding and inserting the corresponding Ethernet packets.

However, this must be done with limited capabilities, e.g. available for nodes operating in a cluster.

The invention adds to the above second application scenario two tunnel endpoints, a tunnel client node, i.e. the third network element, and a tunnel server node, i.e. the fourth network element. The tunnel server node and the tunnel client node may alternatively be arranged, for example, in the opposite direction to that shown in the present example.

The server node is placed inside the internal network with a static port exposed through the access node. In the uplink, the tunnel client node intercepts all external network traffic by putting its Ethernet device or virtual network interface/network element in a promiscuous mode and sniffing incoming packets. The term sniffing refers to the fact that all packets are specifically filtered for packets with the desired address. The functionality of sniffing is only possible when the Ethernet device is in promiscuous mode.

Alternatively, the Ethernet device of the corresponding network node of the external network can be operated in a non-promiscuous mode, for example. In this case, the user network node is equipped with a further network device, in particular a virtual TAP network interface. In the External network, the user network node has the user right to create a virtual network interface.

The packets destined for the destination node from the user node are forwarded (via the access node) to the tunnel server node. The server node also uses a promiscuous mode to transmit the tunneled Ethernet frames into the internal network for the destination network node to receive.

The tunnel client node is not necessarily limited to the same limited permissions. For example, if the client node has the necessary capabilities, it can use existing IP tunnel implementations. However, for compatibility reasons, it might make sense to use the same tunnel (and IP stack) implementation in both tunnel endpoints.

The core idea of the invention is thus to add a server node in the constrained environment and use the promiscuous mode in its Ethernet controller to establish an IP tunnel to the external network.

This is also possible in constrained environments such as clusters, as it requires skills other than creating traditional IP tunnels, which are usually granted to user-space applications, to pass non-IP protocol Ethernet frames such as ICMP frames, e.g. "ping ' to send/receive.

In Linux-based systems, this requires e.g. NET_RAW capabilities in the server node. This capability can be used within the cluster by default, as this capability is also required by basic Linux network utilities such as "ping" to generate ICMP frames.

The invention makes use of this capability to create a user space tunnel endpoint, or IP tunnel endpoint, for the internal network in the cluster, the Ethernet Fra mes on the internal network (from destination node to user node), forwards those packets to the other tunnel endpoint in the external network, and receives Ethernet frames (from user node to destination node) from the other IP tunnel endpoint and converts those frames into feeds the internal network.

The tunnel client node can be implemented equivalently. However, if it is not bound by the same restricted rights, it can use existing IP tunnel implementations, for example.

An implementation of the invention on Linux-based systems temporarily requires NET_ADMIN capabilities in the server node to set its ethernet device to promiscuous mode.

In a cluster, this capability must be added to the server node when it is created. Since it is only required at startup, the corresponding process can delete the ability after startup.

In order for IP communication to work, all communication partners (nodes) must know the IP and MAC (/hardware) addresses of the other node. Since the MAC addresses are initially unknown, ARP broadcast requests are sent as the first step in every IP communication.

In order for IP packets in the external network to be routed from the user network node to the client node via network switches, the client node must answer ARP requests from the user network node that are intended for the destination network node. Equivalently, the server node must answer ARP requests from the destination network node intended for the user network node.

Depending on the routing policy in the internal network, the server node may not be allowed to send or forward packets from user network nodes because they do not match the IP and MAC address assigned to the server node (IP spoofing).

In this case, the server node must hide the user network node's IP and MAC address by replacing the addresses and checksums in the raw Ethernet frame with its own addresses.

If the user node's IP is spoofed, i.e. the user node's packets are forwarded with the server node's IP and MAC address, the IP stack in the server node's Linux kernel must be disabled because it would answer every received IP packet, even if it is destined for the user node.

This can be achieved, for example, by deleting the IP address in the server node after startup. When the server node's Ethernet interface is in promiscuous mode, the tunnel server application can still capture and send raw Ethernet frames.

An implementation on Linux based systems temporarily needs NET_ADMIN skills to clear the IP address of the server node. This ability is only required at launch and can be cleared after launch.

Dropping the server node IP address introduces a new problem. Since the local kernel IP stack no longer processes received packets, one needs a user-space IP stack implementation in the tunneling application to generate and parse tunnel packets to and from the client node.

In addition, the tunneling application must be able to distinguish between captured frames from the client node (“tunnel frames”) and captured frames from the provider node (“frames to be tunnelled”). This can be achieved simply by evaluating the source MAC address in the Ethernet header.

The invention thus offers a number of advantages such as transparency, i.e. the solution changes neither the configuration of the target and/or user network node nor their implementations, i.e. there is no effort for porting service applications into a cluster setup with restricted user rights .

Furthermore, a default cluster configuration can be chosen, i.e. there is no need to change the configuration of clusters or the implementation of clusters e.g. by adding network plugins like multus-cni for Kubernetes.

If the cluster is not hosted on its own servers, but will use 3rd party cluster services, the user may not have sufficient rights to change the configuration of the cluster.

The solution according to the invention can therefore be implemented with restricted rights that are usually available to the nodes in a cluster.

A network node is an entity that is connected to at least one Ethernet (sub)network. For example, this can be a Docker container, a Kubernetes pod, a virtual machine, a physical PC, or a composite of multiple nodes. The network node has a unique IP in the connected Ethernet (sub) network(s). The term network node is not used synonymously with the cluster term master/worker node.

A computer cluster, or cluster network, is a group of loosely or tightly coupled computers that work together in many ways to be considered a single system.

The cluster is managed by container orchestration software, e.g. Kubernetes, which is responsible for container deployment, scaling, dynamic resource allocation (such as compute, network, storage), reliability, load balancing, traffic steering, and data security .

The second network element, specifically the cluster network, typically does not have the user right to create a virtual network interface. The reason for this is that the service provider of the cluster network only grants users limited user rights for security reasons, since a large number of users share the available resources if such cluster networks are hosted in a cloud environment, for example .

Promiscuous mode is a mode for network interface controllers that causes the controller to forward all traffic it receives to a central processing unit (CPU) instead of only forwarding the frames that the controller is specifically programmed to receive.

The message is a communication packet, i.e. a first or inner bit stream. An envelope in which a network element packs a message is a UDP packet or an outer bit stream. The first or inner bit stream is then packed in the envelope, i.e. the UDP packet or outer bit stream.

An IP tunnel is an Internet Protocol network communication channel between two networks. It is used to transport another network protocol by encapsulating its packets. With IP tunneling, each IP packet, including the addressing information of its source and destination IP network, is encapsulated in a different packet format native to the transit network.

Further embodiments of the present invention are the subject of the further dependent claims and the following description with reference to the figures.

According to a preferred development of the invention, it is provided that the first network element sends a first message to the first network, the first message being sent to an IP address and a port of the second network element or to an IP address and a port of another Network element, which is converted into an IP address and a port of the second network element by a further network element, in particular the third network element and/or fourth network element, is addressed.

According to a further preferred development of the invention, it is provided that the third network element receives incoming packets of the first message in the first network, with the third network element packing the first message in a first envelope, and with a network controller of the third network element in a promiscuous mode or a non-promiscuous mode.

The network controller of the third network element thus receives the first message created by the user network node and packs it into the first envelope.

According to a further preferred development of the invention, the first message packed in the first envelope is addressed to a first tunnel port of the access element and sent by the third network element to the first tunnel port of the access element. The access element advantageously enables the transmission of the first message from the first network to the second network.

The first tunnel port of the access element is preconfigured in such a way that the first tunnel port automatically sends incoming messages to the physical or virtual fourth network element, in particular a server network node. Efficient communication with the fourth network element can thus be achieved in an advantageous manner.

According to a further preferred development of the invention, it is provided that the physical or virtual fourth network element, in particular The server network node unpacks the first message received from the access element and packed in the first envelope, and the unpacked first message is sent by the fourth network element using the promiscuous mode, via the second network to the second network element, in particular the destination network node being sent. The first message can thus be sent using the IP tunnel from the user network node via the third network element and the fourth network element to the destination network node.

According to a further preferred development of the invention, it is provided that the second network element, using a dynamically assigned port of the second network element, sends a second message to the second network, the second message being sent to an IP address and a port of the first Network element is addressed.

According to a further preferred development of the invention, it is provided that the fourth network element receives, in particular sniffs, incoming packets of the second message into the second network using the promiscuous mode of the network controller of the fourth network element, and the fourth network element converts the second message into a second sleeve packed. The network controller of the fourth network element thus receives the second message created by the destination network node and packs it into the second envelope.

According to a further preferred development of the invention, the second message packed in the second envelope is addressed to a second tunnel port of the access element and is sent from the fourth network element to the second tunnel port of the access element.

The access element advantageously enables the transmission of the second message from the second network to the first network.

According to a further preferred development of the invention, it is provided that the second tunnel port of the access element is configured dynamically, in particular at runtime using information from the first message, in such a way that the second tunnel port automatically forwards incoming messages to the physical or virtual third network element, in particular a client network node, sends. Efficient communication with the third network element can thus be achieved in an advantageous manner.

According to a further preferred development of the invention, it is provided that the physical or virtual third network element, in particular the client network node, unpacks the second message received from the access element and packed in the second envelope, and the unpacked second message from the third Network element is sent via the first network to the first network element, in particular the user network node.

The second message can thus be sent using the IP tunnel from the destination network node via the fourth network element and the third network element to the user network node.

According to a further preferred development of the invention, it is provided that the first message has a sender IP and MAC address of the first network element, with the third network element or the fourth network element carrying the sender IP and MAC address of the first network element replaced by an IP and MAC address of the fourth network element. The first message can thus advantageously be addressed to the destination network node via the third or fourth network element.

According to a further preferred development of the invention, it is provided that the second message has a recipient IP and MAC address, in particular the fourth network element, with one of the end points of the IP tunnel, in particular the first network element, the third network element or the fourth network element replaces the recipient IP and MAC address of the second message with an IP and MAC address of the first network element. The second message can thus advantageously be addressed to the user network node via the third or fourth network element.

The method described here for data transmission in a network system can also be used on the network system according to the invention and vice versa.

character list

For a better understanding of the present invention and the advantages thereof, reference is now made to the following description in connection with the accompanying drawings.

The invention is explained in more detail below using exemplary embodiments which are indicated in the schematic illustrations of the drawings.

• 1 ein Ablaufdiagramm eines Verfahrens zur Datenübertragung in einem Netzwerksystem sowie eines zugrunde gelegten Netzwerksystems gemäß einer bevorzugten Ausführungsform der Erfindung; und
• 2 ein Ablaufdiagramm des Verfahrens zur Datenübertragung in dem Netzwerksystem sowie des zugrunde gelegten Netzwerksystems gemäß einer weiteren bevorzugten Ausführungsform der Erfindung.

Show it:

• 1 a flowchart of a method for data transmission in a network system and an underlying network system according to a preferred embodiment of the invention; and
• 2 a flowchart of the method for data transmission in the network system and the underlying network system according to a further preferred embodiment of the invention.

This in 1 The method shown for data transmission in a network system 1 comprises providing S1 a first network element 12 connected to a first network 10, in particular a user network node, and a second network element 16 connected to a second network 14, in particular a cluster network, in particular one destination network node. In this case, the second network element 16 does not have the user right to create a virtual network interface.

The method also includes providing S2 a virtual third network element 18 connected to the first network 10 and a virtual fourth network element 20 connected to the second network 14. The third network element 18 and the fourth network element 20 can alternatively be formed physically, for example .

The first network element 12 is connected to the first network 10 via a first network controller. The second network element 16 is connected to the second network 14 via a second network controller.

In addition, the method includes operating S3 a network controller 20a of the fourth network element 20 in a promiscuous mode P and creating S4 an IP tunnel 22 between the first network 10 and the second network 14, the third network element 18 and the fourth Network element 20 are respective endpoints of the IP tunnel 22 routed via an access element 24 .

A first message 26 is first sent from the first network element 12 to the first network 10 . The first message 26 is addressed to an IP address and a port of the second network element 16 .

Alternatively, the first message 26 can be addressed, for example, to an IP address and a port of another network element, which is converted by another network element, in particular the third network element 18 and/or fourth network element 20, into an IP address and a port of the second network element 16 is converted.

The third network element 18 receives incoming packets of the first message 26 in the first network 10. Furthermore, the third network element 18 packs the first message 26 in a first envelope 28. A network controller 18a of the third network element 18 is, according to the present embodiment, in a promiscuous Mode P operated. Alternatively, the network controller can be operated in a non-promiscuous mode, for example.

The first message 26 packed in the first envelope 28 is addressed to a first tunnel port 24a of the access element 24 and is sent by the third network element 18 to the first tunnel port 24a of the access element 24 .

The first tunnel port 24a of the access element 24 is preconfigured in such a way that the first tunnel port 24a automatically sends incoming messages to the virtual fourth network element 20, in particular a server network node.

The virtual fourth network element 20, in particular the server network node, unpacks the first message 26 received from the access element 24 and packed in the first envelope 28. The unpacked first message 26 is also sent by the fourth network element 20 using the promiscuous mode P , sent via the second network 14 to the second network element 16, in particular the destination network node.

A second message 30 is sent from the second network element 16 into the second network 14 using a dynamically assigned port of the second network element 16 . In this case, the second message 30 is addressed to an IP address and a port of the first network element 12 .

The fourth network element 20 receives, in particular sniffs, incoming packets of the second message 30 into the second network 14 using the promiscuous mode P of the network controller 20a of the fourth network element 20. The fourth network element 20 also packs the second message 30 in a second envelope 32

The second message 30 packed in the second envelope 32 is addressed to a second tunnel port 24b of the access element 24 and is transmitted by the fourth network element 20 to the second Tunnel port 24b of access element 24 sent.

The second tunnel port 24b of the access element 24 is configured dynamically, in particular at runtime using information from the first message 26, in such a way that the second tunnel port 24b automatically sends incoming messages to the physical or virtual third network element 18, in particular the client network node.

The virtual third network element 18, in particular the client network node, unpacks the second message 30 received from the access element 24 and packed in the second envelope 32. The unpacked second message 30 is transmitted by the third network element 18 via the first network 10 the first network element 12, in particular the user network node sent.

The first message 26 has an IP and MAC address of the first network element 12, with the third network element 18 or the fourth network element 20 replacing the IP and MAC address of the first network element 12 with an IP and MAC address of the fourth network element 20 replaced. The IP and MAC address of the first network element is in this case a sender IP and MAC address.

The second message 30 also has a recipient IP and MAC address, in particular the fourth network element 20 on. One of the end points of the IP tunnel 22, in particular the first network element 12, the third network element 18 or the fourth network element 20, hereby replaces the recipient IP and MAC address of the second message 30 with an IP and MAC address of the first network element 12.

This in 1 Network system 1 shown for data transmission between a first network element 12 and a second network element 16 comprises a first network element 12 connected to a first network 10, in particular a user network node, and a second network element connected to a second network 14, in particular a cluster network. in particular a destination network node.

In this case, the second network element 16 does not have the user right to create a virtual network interface. Furthermore, the network system 1 comprises a third network element connected to the first network 10 and a fourth virtual network element connected to the second network 14 .

The third network element 18 and the fourth network element 20 can alternatively be formed physically, for example. A network controller 20a of the fourth network element 20 is operable in a promiscuous P mode. Furthermore, the third network element 18 and the fourth network element 20 are respective end points of an IP tunnel 22 routed via an access element 24.

2 shows a flow chart of the method for data transmission in the network system and of the underlying network system according to a further preferred embodiment of the invention.

The method includes providing S1' a first network element 112, in particular a user network node, connected to a first network 10, and a second network element 116, in particular a target network node, connected to a second network 114, in particular a cluster network the second network element 116 does not have the user right to create a virtual network interface.

The method also includes providing S2' a physical or virtual third network element 120 connected to the second network 114 and operating S3' a network controller 120a of the third network element 120 in a promiscuous mode P'.

The method also includes creating S4' an IP tunnel 122 between the first network 110 and the second network 114, the first network element 112 and the third network element 120 being respective end points of the IP tunnel 122 routed via an access element 124 .

Apart from the changed network architecture of this embodiment, the network communication is analogous to that in 1 illustrated procedure. Therefore, these steps will not be repeated.

This in 2 Network system 1 shown for data transmission between a first network element 12 and a second network element 16 comprises a network system 100 for data transmission between a first network element 112 and a second network element 116, comprising a first network element connected to a first network 110, in particular a user network node and a second network element connected to a second network 114, in particular a cluster network, in particular a destination network node.

In this case, the second network element 116 does not have the user right to create a virtual network interface.

Furthermore, the network system 1 comprises a virtual third network element connected to the second network 114, wherein a network controller 120a of the third network element 120 can be operated in a promiscuous mode P′.

An IP tunnel 122 is created between the first network 110 and the second network 114 , the first network element 112 and the third network element 120 being respective end points of the IP tunnel 122 routed via an access element 124 .

Reference List

1, 100

network system

10, 110

first network

12, 112

first network element

14, 114

second network

16, 116

second network element

18

third network element

18a

network controller

20

fourth network element

20a

network controller

22, 122

IP tunnel

24, 124

access element

24a

first tunnel port

24b

second tunnel port

26

first message

28

first shell

30

second message

32

second shell

120

third network element

120a

network controller

P

promiscuous mode

S1-S4

process steps

S1'-S4'

process steps

Claims (16)

Method for data transmission in a network system (1) comprising the steps: Providing (S1) a first network element (12) connected to a first network (10), in particular a user network node, and a second network element (16), in particular a target network node, connected to a second network (14), in particular a cluster network, wherein the second network element (16) does not have the user right to create a virtual network interface; Providing (S2) a physical or virtual third network element (18) connected to the first network (10) and a physical or virtual network element connected to the second network (14). virtual, fourth network element (20); Operating (S3) a network controller (20a) of the fourth network element (20) in a promiscuous mode (P); and Creating (S4) an IP tunnel (22) between the first network (10) and the second network (14), wherein the third network element (18) and the fourth network element (20) are respective end points of the IP tunnel (22) routed via an access element (24). procedure after claim 1 , wherein the first network element (12) sends a first message (26) to the first network (10), the first message (26) to an IP address and a port of the second network element (16) or to an IP - Address and a port of another network element, which is addressed by a further network element, in particular the third network element (18) and/or fourth network element (20), into an IP address and a port of the second network element (16). . procedure after claim 1 or 2 , wherein the third network element (18) in the first network (10) incoming packets of the first message (26) receives, wherein the third network element (18) packs the first message (26) in a first envelope (28), and wherein a Network controller (18a) of the third network element (18) is operated in a promiscuous mode (P) or a non-promiscuous mode. procedure after claim 3 , wherein the first message (26) packaged in the first envelope (28) is addressed to a first tunnel port (24a) of the access element (24) and from the third network element (18) to the first tunnel port (24a ) of the access element (24) is sent. procedure after claim 4 , wherein the first tunnel port (24a) of the access element (24) is preconfigured in such a way that the first tunnel port (24a) automatically sends incoming messages to the physical or virtual fourth network element (20), in particular a server network node, sends. Procedure according to one of claims 3 until 5 , wherein the physical or virtual fourth network element (20), in particular the server network node, unpacks the first message (26) received from the access element (24) and into the first envelope (28), and wherein the unpacked first message (26) is sent by the fourth network element (20) using the promiscuous mode (P), via the second network (14) to the second network element (16), in particular the destination network node. Method according to one of the preceding claims, wherein a second message (30) is sent into the second network (14) by the second network element (16), using a dynamically assigned port of the second network element (16), the second message ( 30) is addressed to an IP address and a port of the first network element (12). Method according to one of the preceding claims, wherein the fourth network element (20) in the second network (14) incoming packets of the second message (30) using the promiscuous mode (P) of the network controller (20a) of the fourth network element (20) receives, in particular sniffs, and wherein the fourth network element (20) packs the second message (30) in a second envelope (32). procedure after claim 8 , wherein the second message (30) packaged in the second envelope (32) is addressed to a second tunnel port (24b) of the access element (24) and from the fourth network element (20) to the second tunnel port (24b ) of the access element (24) is sent. procedure after claim 9 , The second tunnel port (24b) of the access element (24) being configured dynamically, in particular at runtime using information from the first message (26), such that the second tunnel port (24b) receives incoming messages automatically to the physical or virtual third network element (18), in particular a client network node. Procedure according to one of Claims 7 until 10 , wherein the physical or virtual third network element (18), in particular the client network node, unpacks the second message (30) received from the access element (24) and packed in the second envelope (32), and wherein the unpacked second message (30) is sent from the third network element (18) via the first network (10) to the first network element (12), in particular the user network node. Method according to one of the preceding claims, wherein the first message (26) comprises a sender IP and MAC address of the first network element (12), the third network element (18) or the fourth network element (20), the sender IP - Replaced the MAC address of the first network element (12) with an IP and MAC address of the fourth network element (20). Method according to one of the preceding claims, wherein the second message (30) has a recipient IP and MAC address, in particular the fourth network element (20), wherein one of the end points of the IP tunnel (22), in particular the first network element (12), the third network element (18) or the fourth network element (20) replaces the recipient IP and MAC address of the second message (30) with an IP and MAC address of the first network element (12). Method for data transmission in a network system (100) comprising the steps: Providing (S1') a first network element (112) connected to a first network (110), in particular a user network node, and a second network element (116), in particular a target network node, connected to a second network (114), in particular a cluster network, wherein the second network element (116) does not have the user right to create a virtual network interface; providing (S2') a physical or virtual third network element (120) connected to the second network (114); operating (S3') a network controller (120a) of the third network element (120) in a promiscuous mode (P'); and Creating (S4 ') an IP tunnel (122) between the first network (110) and the second network (114), wherein the first network element (112) and the third network element (120) respective end points of the via an access element ( 124) routed IP tunnels (122). Network system (1) for data transmission between a first network element (12) and a second network element (16), comprising: a first network element connected to a first network (10), in particular a user network node; a second network element, in particular a target network node, connected to a second network (14), in particular a cluster network, wherein the second network element (16) does not have the user right to create a virtual network interface; a third network element, physical or virtual, connected to the first network (10); and a, connected to the second network (14), Physical or virtual, fourth network element, wherein a network controller (20a) of the fourth network element (20) is operable in a promiscuous mode (P), and wherein the third network element (18) and the fourth network element (20) have respective endpoints of a via an access element (24) guided IP tunnel (22). Network system (100) for data transmission between a first network element (112) and a second network element (116), comprising: a first network element connected to a first network (110), in particular a user network node; a second network element, in particular a target network node, connected to a second network (114), in particular a cluster network, wherein the second network element (116) does not have the user right to create a virtual network interface; and a physical or virtual third network element (120) connected to the second network (114), wherein a network controller (120a) of the third network element (120) is operable in a promiscuous mode (P'), wherein between the first Network (110) and the second network (114) an IP tunnel (122) is created, wherein the first network element (112) and the third network element (120) are respective end points of the IP tunnel (122) routed via an access element (124).

Images